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Claims 

What is claimed is: 



1 1 . A method for detecting viruses in software, comprising: 

2 (a) comparing data with a plurality of virus definitions in a first database; 

3 (b) executing a security event if the data is successfully compared with at least 

4 one of the virus definitions; 

5 (c) comparing the data with fingerprints of innocent data in a second database; 

6 (d) allowing access to the data if the data is successfully compared to the 

7 fingerprints of innocent data; and 

8 (e) transmitting information to a server for analysis purposes if the data is 

9 unsuccessfully compared to the virus definitions and the fingerprints of 
10 innocent data. 

1 2. The method as recited in claim 1, wherein the security event is selected from 

2 the group consisting of cleaning the data, quarantining the data, and blocking 

3 the data. 

1 3. The method as recited in claim 1 } and further comprising reporting that the 

2 data is innocent if the data is successfully compared to the fingerprints of 

3 innocent data. 

1 4. The method as recited in claim 1 , wherein the information transmitted to the 

2 server includes the data. 

1 5. The method as recited in claim 1 , wherein the information transmitted to the 

2 server includes a fingerprint associated with the data. 
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The method as recited in claim 5, and further comprising comparing the 
fingerprint associated with the data and fingerprints associated with innocent 
data in a third database at the server. 

The method as recited in claim 6, and further comprising comparing the 
fingerprint associated with the data and fingerprints associated with virus 
definitions in a fourth database at the server. 

The method as recited in claim 7, wherein the third and fourth databases are 
updated more frequently than the first and second databases. 

The method as recited in claim 7, and further comprising transmitting the 
data to the server utilizing the network upon an unsuccessful comparison of 
the fingerprint associated with the data and fingerprints associated with the 
innocent data in the third database and the virus definitions in the fourth 
database at the server. 

The method as recited in claim 9, and further comprising analyzing the data 
transmitted to the server. 

The method as recited in claim 9, wherein the data is transmitted to the 
server in separate parts. 

The method as recited in claim 10, and further comprising updating at least 
one of the first database, the second database, the third database, and the 
fourth database based on the analysis. 

The method as recited in claim 1 , wherein the information is transmitted to 
the server via the Internet. 
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1 


14. 


The method as recited in claim 1 , wherein the first database and the second 


2 




database are both components of a client computer coupled to the server via 


3 




the network. 


1 


15. 


A computer program product for detecting viruses in software, comprising: 


2 


(a) 


computer code for comparing data with a plurality of virus definitions in a 


3 




first database; 


4 


(b) 


computer code for executing a security event if the data is successfully 


5 




compared with at least one of the virus definitions; 




(c) 


computer code for comparing the data with fingerprints of innocent data in a 


y3 7 
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(d) 


computer code for allowing access to the data if the data is successfully 


CI 9 




compared to the fingerprints of innocent data; and 




(e) 


computer code for transmitting information to a server for analysis purposes 






if the data is unsuccessfully compared to the virus definitions and the 






fingerprints of innocent data. 


!U i 
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16. 


The computer program product as recited in claim 1 5, wherein the security 






event is seiectea rrom me group consisting 01 cleaning the data, quarantining 


y ; 3 




the data, and blocking the data. 


l 


17. 


The computer program product as recited in claim 1 5, and further comprising 


2 




computer code for reporting that the data is innocent if the data is 


3 




successfully compared to the fingerprints of innocent data. 


1 


18. 


The computer program product as recited in claim 15, wherein the 


2 




information transmitted to the server includes the data. 



1 19. 
2 

3 



The computer program product as recited in claim 15, wherein the 
information transmitted to the server includes a fingerprint associated with 
the data. 
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1 20. The computer program product as recited in claim 19, and further comprising 

2 computer code for comparing the fingerprint associated with the data and 

3 fingerprints associated with innocent data in a third database at the server. 

1 21. The computer program product as recited in claim 20, and further comprising 

2 computer code for comparing the fingerprint associated with the data and 

3 fingerprints associated with virus definitions in a fourth database at the 

4 server. 

m 122. The computer program product as recited in claim 2 1 , wherein the third and 

2 fourth databases are updated more frequently than the first and second 

ff! 3 databases. 

a s H 

M* 123. The computer program product as recited in claim 2 1 , and further comprising 

2 computer code for transmitting the data to the server utilizing the network 

\| 3 u P on a n unsuccessful comparison of the fingerprint associated with the data 

[y 4 and fingerprints associated with the innocent data in the third database and 

f|.J s 

^ 5 the virus definitions in the fourth database at the server. 



1 



24. The computer program product as recited in claim 23, and further comprising 



2 computer code for analyzing the data transmitted to the server. 

1 25. The computer program product as recited in claim 24, wherein the data is 

2 transmitted to the server in separate parts. 



1 26. 



The computer program product as recited in claim 24, and further comprising 



2 computer code for updating at least one of the first database, the second 

3 database, the third database, and the fourth database based on the analysis. 
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1 

I 


11 


The computer program product as recited in claim 15, wherein the 


2 




information is transmitted to the server via the Internet. 


1 


28. 


The computer program product as recited in claim 15, wherein the first 


2 




database and the second database are both components of a client computer 


3 




coupled to the server via the network. 


1 


29. 


A system for detecting viruses in software, comprising: 


2 


(a) 


logic for comparing data with a plurality of virus definitions in a first 


3 




database; 


4 


(b) 


logic for executing a security event if the data is successfully compared with 


5 




at least one of the virus definitions; 


6 


(c) 


logic for comparing the data with fingerprints of innocent data in a second 


7 




database; 


8 


(d) 


logic for allowing access to the data if the data is successfully compared to 


9 




the fingerprints of innocent data; and 


10 


0) 


logic for transmitting information for analysis purposes if the data is 


11 




unsuccessfully compared to the virus definitions and the fingerprints of 


12 




innocent data. 


1 


30. 


A client-based method for detecting viruses in software, comprising: 


2 


(a) 


comparing data with a plurality of virus definitions in a first database; 


3 


(b) 


executing a security event if the data is successfully compared with at least 


4 




one of the virus definitions; 


5 


(c) 


comparing the data with fingerprints of innocent data in a second database; 


6 


(d) 


reporting that the data is innocent if the data is successfully compared to the 


7 




fingerprints of innocent data; and 


8 


(e) 


transmitting the data over a network for analysis purposes if the data is 


9 




unsuccessfully compared to the virus definitions and the fingerprints of 


10 




innocent data. 



-22- 





1 


31. 


A server-based method for detecting viruses in software, comprising: 




2 


(a) 


receiving a fingerprint associated with data from a client computer for 




3 




analysis purposes upon the data being unsuccessfully compared to virus 




4 




definitions and fingerprints of innocent data stored on the client computer; 




5 


(b) 


comparing the fingerprint associated with the data and fingerprints associated 




6 




with fingerprints of innocent data at a server; 




7 


(c) 


comparing the fingerprint associated with the data and fingerprints associated 




8 




with virus definitions at the server; 




9 


(d) 


requesting the data from the client computer utilizing the network upon an 




10 




unsuccessful comparison of the fingerprint associated with the data, and the 




11 




fingerprints associated with the innocent data and the virus definitions at the 




12 




server. 


01 

i 


13 


(e) 


receiving the data transmitted from the client computer in response to the 




14 




request; 




15 


(f) 


analyzing the data transmitted from the client computer; and 


iirrs 


16 


(g) 


updating at least one of the virus definitions and the fingerprints of innocent 




17 




data based on the analysis. 


01 


1 


32. 


A server-based method for detecting viruses in software, comprising: 




2 


(a) 


receiving a fingerprint associated with data from a client computer for 




3 




analysis purposes upon the data being unsuccessfully compared to virus 




4 




definitions stored on the client computer; 




5 


(b) 


comparing the fingerprint associated with the data, and fingerprints 




6 




associated with virus definitions at a server; 




7 


(c) 


requesting the data from the client computer utilizing the network upon an 




8 




unsuccessful comparison of the fingerprint associated with the data, and the 




9 




fingerprints associated with the virus definitions at the server; 




10 


(d) 


receiving the data transmitted from the client computer in response to the 




11 




request; 




12 


(e) 


analyzing the data transmitted from the client computer; and 




13 


(f) 


updating the virus definitions based on the analysis. 
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1 33. A server-based security method, comprising: 

2 (a) receiving a fingerprint associated with data from a client computer for 

3 analysis purposes upon the data being unsuccessfully compared to 

4 fingerprints associated with innocent data stored on the client computer; 

5 (b) comparing the fingerprint associated with the data, and fingerprints 

6 associated with innocent data at a server; 

7 (c) requesting the data from the client computer utilizing the network upon an - 

8 unsuccessful comparison of the fingerprint associated with the data, and the 

9 fingerprints associated with the innocent data at the server; 

1 0 (d) receiving the data transmitted from the client computer in response to the 

1 1 request; 

12 (e) analyzing the data transmitted from the client computer; and 

1 3 (f) updating the fingerprints associated with the innocent data based on the 

14 analysis. 
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